npm - @kweaver-ai/kweaver-sdk - Versions diffs - 0.4.12 → 0.4.14 - Mend

@kweaver-ai/kweaver-sdk 0.4.12 → 0.4.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/README.md +40 -3
package/README.zh.md +40 -2
package/dist/api/business-domains.d.ts +20 -0
package/dist/api/business-domains.js +54 -0
package/dist/api/dataflow.d.ts +2 -0
package/dist/api/dataflow.js +5 -3
package/dist/api/dataviews.d.ts +41 -1
package/dist/api/dataviews.js +58 -5
package/dist/api/vega.js +1 -1
package/dist/auth/oauth.d.ts +30 -0
package/dist/auth/oauth.js +235 -54
package/dist/cli.js +6 -2
package/dist/commands/agent.js +15 -15
package/dist/commands/auth.js +84 -6
package/dist/commands/bkn.d.ts +11 -0
package/dist/commands/bkn.js +90 -55
package/dist/commands/config.js +34 -1
package/dist/commands/dataview.js +61 -2
package/dist/commands/vega.js +7 -7
package/dist/config/store.d.ts +8 -0
package/dist/config/store.js +39 -0
package/dist/index.d.ts +5 -3
package/dist/index.js +3 -2
package/dist/resources/dataviews.d.ts +10 -1
package/dist/resources/dataviews.js +14 -1
package/package.json +1 -1

package/dist/auth/oauth.js CHANGED Viewed

@@ -5,6 +5,87 @@ const TOKEN_TTL_SECONDS = 3600;
 const REFRESH_THRESHOLD_SEC = 60;
 const DEFAULT_REDIRECT_PORT = 9010;
 const DEFAULT_SCOPE = "openid offline all";
+/** POSIX shell single-quote escaping for copy-paste commands. */
+export function shellQuoteForShell(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Build a one-line `kweaver auth login ...` command for headless / other machines.
+ * Omits `--client-secret` when empty (PKCE-only client); headless refresh may still require a confidential client.
+ */
+export function buildCopyCommand(baseUrl, clientId, clientSecret, refreshToken, tlsInsecure) {
+    const parts = ["kweaver", "auth", "login", shellQuoteForShell(normalizeBaseUrl(baseUrl)), "--client-id", shellQuoteForShell(clientId)];
+    if (clientSecret) {
+        parts.push("--client-secret", shellQuoteForShell(clientSecret));
+    }
+    if (refreshToken) {
+        parts.push("--refresh-token", shellQuoteForShell(refreshToken));
+    }
+    if (tlsInsecure) {
+        parts.push("--insecure");
+    }
+    return parts.join(" ");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+/**
+ * HTML shown after successful OAuth callback with a copyable headless login command.
+ */
+export function buildCallbackHtml(copyCommand) {
+    const safeCmd = escapeHtml(copyCommand);
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8"/>
+  <meta name="viewport" content="width=device-width, initial-scale=1"/>
+  <title>Login successful</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 52rem; margin: 2rem auto; padding: 0 1rem; line-height: 1.5; }
+    pre { background: #f4f4f5; padding: 1rem; border-radius: 6px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; }
+    button { margin-top: 0.75rem; padding: 0.5rem 1rem; cursor: pointer; }
+    .warn { color: #b45309; margin-top: 1.5rem; font-size: 0.9rem; }
+  </style>
+</head>
+<body>
+  <h2>Login successful</h2>
+  <p>You can close this tab.</p>
+  <h3>Headless machine</h3>
+  <p>On the computer that has no browser (SSH server, CI runner, container), run:</p>
+  <pre id="kw-cmd">${safeCmd}</pre>
+  <button type="button" id="kw-copy">Copy command</button>
+  <p class="warn">Keep these credentials secure. Anyone with the refresh token and client secret can obtain new access tokens.</p>
+  <script>
+    (function () {
+      var btn = document.getElementById("kw-copy");
+      var pre = document.getElementById("kw-cmd");
+      if (btn && pre) {
+        btn.addEventListener("click", function () {
+          var text = pre.textContent || "";
+          if (navigator.clipboard && navigator.clipboard.writeText) {
+            navigator.clipboard.writeText(text.trim()).then(function () {
+              btn.textContent = "Copied";
+              setTimeout(function () { btn.textContent = "Copy command"; }, 2000);
+            });
+          } else {
+            window.prompt("Copy this command:", text.trim());
+          }
+        });
+      }
+    })();
+  </script>
+</body>
+</html>`;
+}
+function buildCallbackExchangeErrorHtml(message) {
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"/><title>Login error</title></head>
+<body><h2>Login error</h2><pre>${escapeHtml(message)}</pre></body></html>`;
+}
 export function normalizeBaseUrl(value) {
     return value.replace(/\/+$/, "");
 }
@@ -96,35 +177,62 @@ export async function oauth2Login(baseUrl, options) {
             authParams.set("code_challenge_method", "S256");
         }
         const authUrl = `${base}/oauth2/auth?${authParams.toString()}`;
-        // Step 4: Start local callback server, wait for code
-        const code = await new Promise((resolve, reject) => {
+        // Step 4: Start local callback server; exchange code inside handler, then show credentials HTML
+        const token = await new Promise((resolve, reject) => {
+            let server;
             const timeoutId = setTimeout(() => {
-                server.close();
+                server?.close();
                 reject(new Error("OAuth2 login timed out (120s). No authorization code received."));
             }, 120_000);
-            const server = createServer((req, res) => {
-                const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-                if (url.pathname === "/callback") {
-                    const receivedState = url.searchParams.get("state");
-                    const receivedCode = url.searchParams.get("code");
-                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end("<html><body><h2>Login successful. You can close this tab.</h2></body></html>");
-                    clearTimeout(timeoutId);
-                    server.close();
-                    if (receivedState !== state) {
-                        reject(new Error("OAuth2 state mismatch — possible CSRF attack."));
-                    }
-                    else if (!receivedCode) {
-                        reject(new Error("No authorization code received in callback."));
+            server = createServer((req, res) => {
+                void (async () => {
+                    try {
+                        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+                        if (url.pathname !== "/callback") {
+                            res.writeHead(404);
+                            res.end();
+                            return;
+                        }
+                        const receivedState = url.searchParams.get("state");
+                        const receivedCode = url.searchParams.get("code");
+                        if (receivedState !== state) {
+                            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml("OAuth2 state mismatch — possible CSRF attack."));
+                            clearTimeout(timeoutId);
+                            server.close();
+                            reject(new Error("OAuth2 state mismatch — possible CSRF attack."));
+                            return;
+                        }
+                        if (!receivedCode) {
+                            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml("No authorization code received in callback."));
+                            clearTimeout(timeoutId);
+                            server.close();
+                            reject(new Error("No authorization code received in callback."));
+                            return;
+                        }
+                        const exchanged = await exchangeCodeForToken(base, receivedCode, client.clientId, client.clientSecret, redirectUri, pkce?.verifier, options?.tlsInsecure);
+                        const copyCommand = buildCopyCommand(base, client.clientId, client.clientSecret, exchanged.refreshToken, options?.tlsInsecure);
+                        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                        res.end(buildCallbackHtml(copyCommand));
+                        clearTimeout(timeoutId);
+                        server.close();
+                        resolve(exchanged);
                     }
-                    else {
-                        resolve(receivedCode);
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        try {
+                            res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml(message));
+                        }
+                        catch {
+                            /* response may already be sent */
+                        }
+                        clearTimeout(timeoutId);
+                        server.close();
+                        reject(err instanceof Error ? err : new Error(message));
                     }
-                }
-                else {
-                    res.writeHead(404);
-                    res.end();
-                }
+                })();
             });
             server.listen(port, "127.0.0.1", () => {
                 // Step 5: Open browser (uses spawn with proper Windows quoting)
@@ -134,8 +242,6 @@ export async function oauth2Login(baseUrl, options) {
                 process.stderr.write(`If the wrong browser opens, copy this URL to your correct browser:\n  ${authUrl}\n`);
             });
         });
-        // Step 6: Exchange code for tokens
-        const token = await exchangeCodeForToken(base, code, client.clientId, client.clientSecret, redirectUri, pkce?.verifier, options?.tlsInsecure);
         setCurrentPlatform(base);
         return token;
     });
@@ -275,40 +381,70 @@ export async function playwrightLogin(baseUrl, options) {
             product: "adp",
         });
         const authUrl = `${base}/oauth2/auth?${authParams.toString()}`;
-        // Step 4: Start local callback server to capture the authorization code
-        const code = await new Promise((resolve, reject) => {
+        // Step 4: Start local callback server; exchange code inside handler, then show credentials HTML
+        let browser;
+        const token = await new Promise((resolve, reject) => {
             const TIMEOUT_MS = hasCredentials ? 30_000 : 120_000;
+            let server;
             const timeoutId = setTimeout(() => {
-                server.close();
+                server?.close();
                 browser?.close();
                 reject(new Error(`OAuth2 login timed out (${TIMEOUT_MS / 1000}s). No authorization code received.`));
             }, TIMEOUT_MS);
-            const server = createServer((req, res) => {
-                const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-                if (url.pathname === "/callback") {
-                    const receivedState = url.searchParams.get("state");
-                    const receivedCode = url.searchParams.get("code");
-                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end("<html><body><h2>Login successful. You can close this tab.</h2></body></html>");
-                    clearTimeout(timeoutId);
-                    server.close();
-                    browser?.close();
-                    if (receivedState !== state) {
-                        reject(new Error("OAuth2 state mismatch — possible CSRF attack."));
-                    }
-                    else if (!receivedCode) {
-                        reject(new Error("No authorization code received in callback."));
+            server = createServer((req, res) => {
+                void (async () => {
+                    try {
+                        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+                        if (url.pathname !== "/callback") {
+                            res.writeHead(404);
+                            res.end();
+                            return;
+                        }
+                        const receivedState = url.searchParams.get("state");
+                        const receivedCode = url.searchParams.get("code");
+                        if (receivedState !== state) {
+                            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml("OAuth2 state mismatch — possible CSRF attack."));
+                            clearTimeout(timeoutId);
+                            server.close();
+                            browser?.close();
+                            reject(new Error("OAuth2 state mismatch — possible CSRF attack."));
+                            return;
+                        }
+                        if (!receivedCode) {
+                            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml("No authorization code received in callback."));
+                            clearTimeout(timeoutId);
+                            server.close();
+                            browser?.close();
+                            reject(new Error("No authorization code received in callback."));
+                            return;
+                        }
+                        const exchanged = await exchangeCodeForToken(base, receivedCode, client.clientId, client.clientSecret, redirectUri, undefined, options?.tlsInsecure);
+                        const copyCommand = buildCopyCommand(base, client.clientId, client.clientSecret, exchanged.refreshToken, options?.tlsInsecure);
+                        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                        res.end(buildCallbackHtml(copyCommand));
+                        clearTimeout(timeoutId);
+                        server.close();
+                        browser?.close();
+                        resolve(exchanged);
                     }
-                    else {
-                        resolve(receivedCode);
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        try {
+                            res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
+                            res.end(buildCallbackExchangeErrorHtml(message));
+                        }
+                        catch {
+                            /* response may already be sent */
+                        }
+                        clearTimeout(timeoutId);
+                        server.close();
+                        browser?.close();
+                        reject(err instanceof Error ? err : new Error(message));
                     }
-                }
-                else {
-                    res.writeHead(404);
-                    res.end();
-                }
+                })();
             });
-            let browser;
             server.listen(port, "127.0.0.1", async () => {
                 try {
                     browser = await chromium.launch({ headless: hasCredentials });
@@ -334,12 +470,48 @@ export async function playwrightLogin(baseUrl, options) {
                 }
             });
         });
-        // Step 5: Exchange authorization code for tokens (includes refresh_token)
-        const token = await exchangeCodeForToken(base, code, client.clientId, client.clientSecret, redirectUri, undefined, options?.tlsInsecure);
+        if (hasCredentials) {
+            const copyCommand = buildCopyCommand(base, client.clientId, client.clientSecret, token.refreshToken, options?.tlsInsecure);
+            process.stderr.write("\nHeadless login: copy this command and run it on a machine without a browser, or use `kweaver auth export`:\n\n" +
+                copyCommand +
+                "\n\n");
+        }
         setCurrentPlatform(base);
         return token;
     });
 }
+/**
+ * Log in on a headless machine using OAuth2 client credentials and a refresh token (no browser).
+ * Exchanges the refresh token for a new access token and persists ~/.kweaver/ state.
+ */
+export async function refreshTokenLogin(baseUrl, options) {
+    const base = normalizeBaseUrl(baseUrl);
+    const redirectUri = `http://127.0.0.1:${DEFAULT_REDIRECT_PORT}/callback`;
+    const client = {
+        baseUrl: base,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        redirectUri,
+        logoutRedirectUri: redirectUri.replace("/callback", "/successful-logout"),
+        scope: DEFAULT_SCOPE,
+        lang: "zh-cn",
+        product: "adp",
+        xForwardedPrefix: "",
+    };
+    saveClientConfig(base, client);
+    const synthetic = {
+        baseUrl: base,
+        accessToken: "",
+        tokenType: "Bearer",
+        scope: "",
+        refreshToken: options.refreshToken,
+        obtainedAt: new Date().toISOString(),
+        ...(options.tlsInsecure ? { tlsInsecure: true } : {}),
+    };
+    const token = await runWithTlsInsecure(options.tlsInsecure, () => refreshAccessToken(synthetic));
+    setCurrentPlatform(base);
+    return token;
+}
 function tokenNeedsRefresh(token) {
     if (!token.expiresAt) {
         return false;
@@ -420,6 +592,15 @@ export async function refreshAccessToken(token) {
     saveTokenConfig(newToken);
     return newToken;
 }
+/**
+ * Resolve a usable access token for the current platform.
+ *
+ * **Default behavior** (saved `~/.kweaver/` session from OAuth2 code login): when the access
+ * token is expired or near expiry, automatically exchanges the saved **refresh_token** for a new
+ * access token (OAuth2 `refresh_token` grant) and persists it. No extra flags are required.
+ *
+ * Static env `KWEAVER_TOKEN` bypasses refresh (see implementation).
+ */
 export async function ensureValidToken(opts) {
     const envToken = process.env.KWEAVER_TOKEN;
     const envBaseUrl = process.env.KWEAVER_BASE_URL;

package/dist/cli.js CHANGED Viewed

@@ -18,6 +18,8 @@ Usage:
   kweaver auth <platform-url> [--alias name] [-u user] [-p pass] [--playwright] [--insecure|-k]
   kweaver auth login <platform-url>          (alias for auth <url>)
+  kweaver auth login <url> --client-id ID --client-secret S --refresh-token T   (run on host without browser)
+  kweaver auth export [platform-url|alias] [--json]
   kweaver auth status [platform-url|alias]
   kweaver auth list
   kweaver auth use <platform-url|alias>
@@ -51,6 +53,7 @@ Usage:
   kweaver dataview list [--datasource-id id] [--type atomic|custom] [--limit n] [-bd value] [--pretty]
   kweaver dataview find --name <name> [--exact] [--datasource-id id] [--wait] [--timeout ms] [-bd value] [--pretty]
   kweaver dataview get <id> [-bd value] [--pretty]
+  kweaver dataview query <id> [--sql sql] [--limit n] [--offset n] [--need-total] [-bd value] [--pretty]
   kweaver dataview delete <id> [-y] [-bd value]
   kweaver bkn list [options]
@@ -74,6 +77,7 @@ Usage:
   kweaver bkn action-log list|get|cancel <kn-id> ...
   kweaver config set-bd <value>
+  kweaver config list-bd
   kweaver config show
   kweaver vega health|stats|inspect
@@ -96,7 +100,7 @@ Commands:
   call (curl)    Call an API with curl-style flags and auto-injected token headers
   agent          Agent CRUD, chat, sessions, history, publish/unpublish
   ds             Manage datasources (list, get, delete, tables, connect)
-  dataview       List, find, get, delete data views (atomic / custom)
+  dataview|dv    List, find, get, query (SQL), delete data views (atomic / custom)
   bkn            Knowledge network (CRUD, build, validate, export, stats, push/pull,
                  object-type, relation-type, subgraph, action-type, action-execution, action-log)
   config         Per-platform configuration (business domain)
@@ -127,7 +131,7 @@ export async function run(argv) {
     if (command === "ds") {
         return runDsCommand(rest);
     }
-    if (command === "dataview") {
+    if (command === "dataview" || command === "dv") {
         return runDataviewCommand(rest);
     }
     if (command === "token") {

package/dist/commands/agent.js CHANGED Viewed

@@ -45,7 +45,7 @@ export function formatSimpleAgentList(text, pretty) {
 export function parseAgentListArgs(args) {
     let name = "";
     let offset = 0;
-    let limit = 50;
+    let limit = 30;
     let category_id = "";
     let custom_space_id = "";
     let is_to_square = 1;
@@ -70,9 +70,9 @@ export function parseAgentListArgs(args) {
             continue;
         }
         if (arg === "--limit") {
-            limit = parseInt(args[i + 1] ?? "50", 10);
+            limit = parseInt(args[i + 1] ?? "30", 10);
             if (Number.isNaN(limit) || limit < 1)
-                limit = 50;
+                limit = 30;
             i += 1;
             continue;
         }
@@ -134,7 +134,7 @@ export function parseAgentSessionsArgs(args) {
         throw new Error("Missing agent_id");
     }
     let businessDomain = "";
-    let limit;
+    let limit = 30;
     let pretty = true;
     for (let i = 1; i < args.length; i += 1) {
         const arg = args[i];
@@ -150,9 +150,9 @@ export function parseAgentSessionsArgs(args) {
             continue;
         }
         if (arg === "--limit") {
-            limit = parseInt(args[i + 1] ?? "0", 10);
+            limit = parseInt(args[i + 1] ?? "30", 10);
             if (Number.isNaN(limit) || limit < 1)
-                limit = undefined;
+                limit = 30;
             i += 1;
             continue;
         }
@@ -176,7 +176,7 @@ export function parseAgentHistoryArgs(args) {
         throw new Error("Missing conversation_id");
     }
     let businessDomain = "";
-    let limit;
+    let limit = 30;
     let pretty = true;
     for (let i = 1; i < args.length; i += 1) {
         const arg = args[i];
@@ -192,9 +192,9 @@ export function parseAgentHistoryArgs(args) {
             continue;
         }
         if (arg === "--limit") {
-            limit = parseInt(args[i + 1] ?? "0", 10);
+            limit = parseInt(args[i + 1] ?? "30", 10);
             if (Number.isNaN(limit) || limit < 1)
-                limit = undefined;
+                limit = 30;
             i += 1;
             continue;
         }
@@ -309,7 +309,7 @@ List published agents from the agent-factory API.
 Options:
   --name <text>             Filter by name
   --offset <n>              Pagination offset (default: 0)
-  --limit <n>               Max items to return (default: 50)
+  --limit <n>               Max items to return (default: 30)
   --category-id <id>        Filter by category
   --custom-space-id <id>    Filter by custom space
   --is-to-square <0|1>      Is to square (default: 1)
@@ -326,7 +326,7 @@ Options:
 List all conversations for an agent.
 Options:
-  --limit <n>              Max conversations to return
+  --limit <n>              Max conversations to return (default: 30)
   -bd, --biz-domain <value> Business domain (default: bd_public)
   --pretty                  Pretty-print JSON output (default)`);
             return 0;
@@ -339,7 +339,7 @@ Options:
 Show message history for a conversation.
 Options:
-  --limit <n>              Max messages to return
+  --limit <n>              Max messages to return (default: 30)
   -bd, --biz-domain <value> Business domain (default: bd_public)
   --pretty                  Pretty-print JSON output (default)`);
             return 0;
@@ -462,7 +462,7 @@ List published agents from the agent-factory API.
 Options:
   --name <text>             Filter by name
   --offset <n>              Pagination offset (default: 0)
-  --limit <n>               Max items to return (default: 50)
+  --limit <n>               Max items to return (default: 30)
   --category-id <id>        Filter by category
   --custom-space-id <id>    Filter by custom space
   --is-to-square <0|1>      Is to square (default: 1)
@@ -509,7 +509,7 @@ async function runAgentSessionsCommand(args) {
 List all conversations for an agent.
 Options:
-  --limit <n>              Max conversations to return
+  --limit <n>              Max conversations to return (default: 30)
   -bd, --biz-domain <value> Business domain (default: bd_public)
   --pretty                  Pretty-print JSON output (default)`);
             return 0;
@@ -546,7 +546,7 @@ async function runAgentHistoryCommand(args) {
 Show message history for a conversation.
 Options:
-  --limit <n>              Max messages to return
+  --limit <n>              Max messages to return (default: 30)
   -bd, --biz-domain <value> Business domain (default: bd_public)
   --pretty                  Pretty-print JSON output (default)`);
             return 0;

package/dist/commands/auth.js CHANGED Viewed

@@ -1,11 +1,12 @@
-import { clearPlatformSession, deletePlatform, getConfigDir, getCurrentPlatform, getPlatformAlias, hasPlatform, listPlatforms, loadTokenConfig, resolvePlatformIdentifier, setCurrentPlatform, setPlatformAlias, } from "../config/store.js";
-import { formatHttpError, normalizeBaseUrl, oauth2Login, playwrightLogin, } from "../auth/oauth.js";
+import { autoSelectBusinessDomain, clearPlatformSession, deletePlatform, getConfigDir, getCurrentPlatform, getPlatformAlias, hasPlatform, listPlatforms, loadClientConfig, loadTokenConfig, resolvePlatformIdentifier, setCurrentPlatform, setPlatformAlias, } from "../config/store.js";
+import { buildCopyCommand, formatHttpError, normalizeBaseUrl, oauth2Login, playwrightLogin, refreshTokenLogin, } from "../auth/oauth.js";
 export async function runAuthCommand(args) {
     const target = args[0];
     const rest = args.slice(1);
     if (!target || target === "--help" || target === "-h") {
         console.log(`kweaver auth login <url> [options]   Login to a platform (browser OAuth2 by default)
 kweaver auth <url>                   Login (shorthand; same options as login)
+kweaver auth export [url|alias] [--json]   Export credentials; run printed command on a headless host
 kweaver auth status [url|alias]      Show current auth status
 kweaver auth list                    List saved platforms
 kweaver auth use <url|alias>         Switch active platform
@@ -18,6 +19,9 @@ Login options:
                          Use the platform's web app client ID to get the same permissions
                          as the browser. Find it in DevTools: /oauth2/auth?client_id=<id>
   --client-secret <s>    Client secret (omit for public/PKCE clients)
+  --refresh-token <t>    Use on a machine without a browser: exchange refresh token for access token.
+                         Requires --client-id and --client-secret.
+                         Get these from the callback page after browser login or \`auth export\`.
   -u, --username         Username (with -p triggers Playwright headless login)
   -p, --password         Password
   --playwright           Force Playwright browser login even without -u/-p
@@ -26,7 +30,7 @@ Login options:
     }
     if (target === "login") {
         if (rest[0] === "--help" || rest[0] === "-h") {
-            console.log(`kweaver auth login <platform-url> [--alias <name>] [-u user] [-p pass] [--playwright]`);
+            console.log(`kweaver auth login <platform-url> [--alias <name>] [-u user] [-p pass] [--playwright] [--refresh-token T --client-id ID --client-secret S]`);
             return 0;
         }
         const url = rest[0];
@@ -36,7 +40,11 @@ Login options:
         }
         return runAuthCommand([url, ...rest.slice(1)]);
     }
-    if (target && target !== "status" && target !== "list" && target !== "use" && target !== "delete" && target !== "logout") {
+    if (target === "export") {
+        return runAuthExportCommand(rest);
+    }
+    const LOGIN_SUBCOMMANDS = new Set(["status", "list", "use", "delete", "logout", "export"]);
+    if (target && !LOGIN_SUBCOMMANDS.has(target)) {
         try {
             const normalizedTarget = normalizeBaseUrl(target);
             const alias = readOption(args, "--alias");
@@ -45,9 +53,21 @@ Login options:
             const usePlaywright = args.includes("--playwright");
             const clientId = readOption(args, "--client-id");
             const clientSecret = readOption(args, "--client-secret");
+            const refreshToken = readOption(args, "--refresh-token");
             const tlsInsecure = args.includes("--insecure") || args.includes("-k");
             let token;
-            if (username && password) {
+            if (refreshToken) {
+                if (!clientId || !clientSecret) {
+                    console.error("--refresh-token requires --client-id and --client-secret.\n");
+                    console.error("Get these values from the callback page after a browser login or `kweaver auth export`.");
+                    return 1;
+                }
+                console.log("Logging in with refresh token (no browser)...");
+                token = await refreshTokenLogin(normalizedTarget, {
+                    clientId, clientSecret, refreshToken, tlsInsecure,
+                });
+            }
+            else if (username && password) {
                 // Headless Playwright login with credentials
                 console.log("Logging in (headless)...");
                 token = await playwrightLogin(normalizedTarget, { username, password, tlsInsecure });
@@ -95,6 +115,10 @@ Login options:
             if (token.expiresAt) {
                 console.log(`Token expires at: ${token.expiresAt}`);
             }
+            const selectedBd = await autoSelectBusinessDomain(normalizedTarget, token.accessToken, {
+                tlsInsecure: token.tlsInsecure,
+            });
+            console.log(`Business domain: ${selectedBd}`);
             return 0;
         }
         catch (error) {
@@ -213,7 +237,7 @@ Login options:
         return 0;
     }
     console.error("Usage: kweaver auth login <platform-url> [--alias <name>] [-u user] [-p pass] [--playwright]");
-    console.error("       kweaver auth <platform-url> [--alias <name>] [-u user] [-p pass] [--playwright]");
+    console.error("       kweaver auth export [platform-url|alias] [--json]");
     console.error("       kweaver auth status [platform-url|alias]");
     console.error("       kweaver auth list");
     console.error("       kweaver auth use <platform-url|alias>");
@@ -221,6 +245,60 @@ Login options:
     console.error("       kweaver auth delete <platform-url|alias>");
     return 1;
 }
+async function runAuthExportCommand(args) {
+    if (args[0] === "--help" || args[0] === "-h") {
+        console.log(`kweaver auth export [platform-url|alias] [--json]
+Export OAuth2 credentials for copying to a headless host (no browser there).
+Prints clientId, clientSecret, refreshToken, and a command to run on that machine.
+Options:
+  --json   Output as JSON (machine-readable)`);
+        return 0;
+    }
+    const jsonOutput = args.includes("--json");
+    const positional = args.find((a) => !a.startsWith("-"));
+    const resolved = positional ? resolvePlatformIdentifier(positional) : null;
+    const platform = resolved && /^https?:\/\//.test(resolved) ? normalizeBaseUrl(resolved) : resolved ?? getCurrentPlatform();
+    if (!platform) {
+        console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
+        return 1;
+    }
+    const client = loadClientConfig(platform);
+    const token = loadTokenConfig(platform);
+    const clientId = client?.clientId ?? "";
+    const clientSecret = client?.clientSecret ?? "";
+    const refreshToken = token?.refreshToken ?? "";
+    const tlsInsecure = token?.tlsInsecure;
+    if (!clientId || !refreshToken) {
+        console.error(`Incomplete credentials for ${platform}.\n` +
+            (!clientId ? "  Missing: client registration (client.json)\n" : "") +
+            (!refreshToken ? "  Missing: refresh token (token.json)\n" : "") +
+            `Run \`kweaver auth login ${platform}\` first.`);
+        return 1;
+    }
+    if (jsonOutput) {
+        console.log(JSON.stringify({
+            baseUrl: platform,
+            clientId,
+            clientSecret,
+            refreshToken,
+            ...(tlsInsecure ? { tlsInsecure: true } : {}),
+        }));
+        return 0;
+    }
+    const cmd = buildCopyCommand(platform, clientId, clientSecret, refreshToken, tlsInsecure);
+    console.log(`Platform:       ${platform}`);
+    console.log(`Client ID:      ${clientId}`);
+    console.log(`Client Secret:  ${clientSecret || "(none)"}`);
+    console.log(`Refresh Token:  ${refreshToken}`);
+    console.log("");
+    console.log("On a machine without a browser, run:\n");
+    console.log(`  ${cmd}`);
+    console.log("");
+    console.log("Keep these credentials secure.");
+    return 0;
+}
 function readOption(args, name) {
     const index = args.findIndex((arg) => arg === name);
     if (index === -1) {